Spam domains that plague my email

[lwf]

Surprised to not see gmail.com in the list[1].

[1]: https://drewdevault.com/2021/02/25/Gmail-is-a-huge-source-of... , https://news.ycombinator.com/item?id=26265329

[dpifke]

DARPA invented a communications network that could survive a nuclear war. Instead, everyone uses Gmail.

If any other source of spam was so resistant to receiving abuse reports, they would be blackholed by everyone.

Thanks, antitrust enforcement.

[inferiorhuman]

When I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.

[prvit]

Despite the title, the article you linked has nothing whatsoever to do with spam coming from Gmail.

[NikhilVerma]

I am seeing Google constantly fail to catch obvious spam emails. At this point I suspect there is some institutional error on their part, where bad actors inside the org are allowing certain domains to simply not be spam filtered.

[chaoz_]

I've done some experiments with Gmail/Outlook/other spam detection clients on different types of spam/phishing etc. There's always someone who claims simple naive bayes algo would do better than Google.

I'm not able to share the research data, but Gmail filter is a lot better than everything else you see on the market, especially when it's not a newsletter-like advertisement spam, but an actual phishing attack on Org.

Some people say Outlook has better filtering func, but usually tests are not representative and Outlook simply has stricter rule for unwarmed-ip. Which is not that great of a feature in real world scenario.

[r1ch]

I've been seeing some cleverly encoded emails with multiple MIME parts that bypass the spam filter. Gmail decodes one representation but displays another. Luckily the content they show to the spam filter is mostly static so a regular filter can catch it.

[prawn]

I mark email from someone spam over and over, and it can still get past Gmail. It's infuriating.

[fuckcensorship]

“Never attribute to malice that which is adequately explained by stupidity.”

[Brajeshwar]

Looks like a very personal list. I would not advice anyone using this as part of anything. Rohith[1] is in India and most of the spam domains (did a quick split) in the list are similar sounding names of a lot of Indian companies/Startups. Not that the companies do not spam (they do) but emails/domain registration has become so easy that there are tiny setups/operations in every nook and corner of the streets/chawls/shanties of India trying to spam people.

1. https://drive.google.com/file/d/1Z7bBo_rMQB0nJYUs8wl4pZeZVUv...

[krageon]

You appear to be trying to argue against something, but it reads as "this is a lot of Indian stuff, which is chock-full of spammers". Read like that, it seems like the list is a good one.

[butz]

In theory one can set any domain to "from" field, what about actual servers that sent the spam? How many of those spam emails have unsubscribe and/or complaint headers?

[avian]

In theory the domain you set the "From:" field to will have DMARC, DKIM and SPF set up and in theory the recipient that implements those protocols will discard your mail as sent from an unauthorized server.

[Ensorceled]

The spam emails pretty much ALL have unsubcribe headers now. I mean, they are all WORSE than useless since they are sending signal back to spammers, but Gmail is asking me to [Unsubscribe and Report Spam] anyway.

[Wronnay]

I have a similar list: https://gitlab.com/cmiksche/blacklists/-/blob/master/hosts

Did you think about adding your list to well known blocklists? You can add it to e.g. OISD

[nubela]

These are usually domains that belong to a disposable email service, be it public or private.

I maintain a 100% free API [1] to check if an email belongs to a disposable email service. We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits.

We use the domains found at https://www.stopforumspam.com/downloads amongst other sources of data. Works pretty well. We have close to eliminated fake account registration with the use of Recaptcha.

[1]: https://nubela.co/proxycurl/disposable-email-checker-api

[uallo]

> We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits.

I usually use disposable emails to test services but don't want to be spammed. Often, I later upgrade to a paid plan if I like the service. If they block disposable email addresses, I will not even try them at all.

[r1ch]

Why does your API want the full email address? That becomes a privacy liability as surely the domain alone is enough.

[krageon]

Congratulations, you make the internet worse for actual humans and better for corporations. Making the world a net worse place, for everyone that matters.

[nikanj]

I use a disposable email address because I don’t want the organization to have my email. Thank you for making that harder.

[jstanley]

What exactly is "fake" about an account one creates with a disposable email address?

[shmde]

> We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits.

Some people just want to watch the world burn.

[corentin88]

Curious about how did you built this? Do you maintain an internal list of domains?

[elashri]

I am surprised to see Washington state university emails used for spam to that extent.

[onphonenow]

The Democratic Party and ngp van?

[egberts1]

But of course,

https://www.theverge.com/2022/6/28/23186742/google-spam-prop...